紧急求救，很多scan.exe和wemc.exe进程

lz9999

最近邮件服务器出了问题，有很多（200多个）scan.exe进程和wemc.exe进程，非常消耗内存，占用内存达到3000M以上，甚至不能上服务器终端进行管理。关闭了邮件服务器后，服务器上的其他网站正常。

一天的系统日志有7M多，始终找不出是什么原因，现把系统日志贴一些上来请各位高人分析一下：这些IP可全是外国的。

Wed, 23 Apr 2008 23:55:57 [85.172.43.197] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:58 [222.246.1.18] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:58 [71.180.160.88] 关闭Smtp连接.
Wed, 23 Apr 2008 23:55:59 [59.42.228.57] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [222.246.1.18] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [84.6.1.99] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [85.172.43.197] 关闭连接.
Wed, 23 Apr 2008 23:55:59 [71.180.160.88] 关闭连接.
Wed, 23 Apr 2008 23:55:59 Smtp登录. IP: 189.60.36.124 , Port 60927
Wed, 23 Apr 2008 23:55:59 Smtp登录. IP: 116.30.90.64 , Port 2269
Wed, 23 Apr 2008 23:56:00 HELO/EHLO 主机名通过验证: ACER511EBA12DF.UNE.NET.CO
Wed, 23 Apr 2008 23:56:00 HELO/EHLO 主机名通过验证: ESTACAO04
Wed, 23 Apr 2008 23:56:01 Smtp登录. IP: 88.247.79.203 , Port 17583
Wed, 23 Apr 2008 23:56:02 [189.60.36.124] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:02 Smtp登录. IP: 121.245.39.198 , Port 22142
Wed, 23 Apr 2008 23:56:02 Smtp登录. IP: 78.36.179.127 , Port 31827
Wed, 23 Apr 2008 23:56:03 [201.233.47.191] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:04 [189.24.135.4] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:05 [121.245.39.198] 关闭连接.
Wed, 23 Apr 2008 23:56:05 [189.60.36.124] 关闭连接.
Wed, 23 Apr 2008 23:56:05 [201.233.47.191] 关闭连接.
Wed, 23 Apr 2008 23:56:05 Smtp登录. IP: 85.179.85.24 , Port 4455
Wed, 23 Apr 2008 23:56:06 HELO/EHLO 主机名通过验证: [78.36.179.127]
Wed, 23 Apr 2008 23:56:08 [189.24.135.4] 关闭连接.
Wed, 23 Apr 2008 23:56:08 接收到一封发往       的邮件.
Wed, 23 Apr 2008 23:56:08 Smtp登录. IP: 88.244.43.183 , Port 2505
Wed, 23 Apr 2008 23:56:10 HELO/EHLO 主机名通过验证: F051103117.ADSL.ALICEDSL.DE
Wed, 23 Apr 2008 23:56:11 Smtp登录. IP: 189.133.171.152 , Port 1922
Wed, 23 Apr 2008 23:56:11 [116.30.90.64] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:11 HELO/EHLO 主机名通过验证: MEDICO
Wed, 23 Apr 2008 23:56:12 [189.133.171.152] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:13 [116.30.90.64] 关闭连接.
Wed, 23 Apr 2008 23:56:13 [189.133.171.152] 关闭连接.
Wed, 23 Apr 2008 23:56:14 [85.179.85.24] 关闭Smtp连接.
Wed, 23 Apr 2008 23:56:14 Smtp登录. IP: 92.113.3.172 , Port 56154
Wed, 23 Apr 2008 23:56:16 [88.247.79.203] 关闭连接.
Wed, 23 Apr 2008 23:56:16 [85.179.85.24] 关闭连接.
Wed, 23 Apr 2008 23:56:21 Smtp登录. IP: 219.134.24.26 , Port 3075

[ 本帖最后由 lz9999 于 2008-4-25 08:30 编辑 ]

humbass

看问题的现象以及winwebmail日志，应该是中毒的症状，为啥把中毒和winwebmail扯上关系

lz9999

老兄，到底是不是中毒？不太明白。

lz9999

清除了很多过期的邮箱，然后按官方设置了防垃圾邮件，最近的日志如下：


Fri, 25 Apr 2008 08:14:19        [70.45.119.92] 关闭连接.
Fri, 25 Apr 2008 08:14:19        [82.154.167.129] 关闭连接.
Fri, 25 Apr 2008 08:14:20        Smtp登录. IP: 121.34.105.149 , Port 2152
Fri, 25 Apr 2008 08:14:21        Smtp登录. IP: 68.153.238.51 , Port 57658
Fri, 25 Apr 2008 08:14:22        Smtp登录. IP: 70.45.119.92 , Port 1090
Fri, 25 Apr 2008 08:14:23        拒收一封邮件, 原因: 域名[shunyuan88.com]与发信IP地址[121.34.105.149]不匹配.
Fri, 25 Apr 2008 08:14:26        [121.34.105.149] 关闭连接.
Fri, 25 Apr 2008 08:14:28        [70.45.119.92] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:28        [68.153.238.51] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:29        Smtp登录. IP: 125.34.157.56 , Port 3428
Fri, 25 Apr 2008 08:14:29        拒收一封邮件, 原因: 域名[china.com]与发信IP地址[125.34.157.56]不匹配.
Fri, 25 Apr 2008 08:14:31        [70.45.119.92] 关闭连接.
Fri, 25 Apr 2008 08:14:31        [68.153.238.51] 关闭连接.
Fri, 25 Apr 2008 08:14:31        [125.34.157.56] 关闭连接.
Fri, 25 Apr 2008 08:14:36        Smtp登录. IP: 71.113.214.128 , Port 61813
Fri, 25 Apr 2008 08:14:37        Smtp登录. IP: 190.128.101.148 , Port 3394
Fri, 25 Apr 2008 08:14:40        Smtp登录. IP: 190.55.122.15 , Port 1803
Fri, 25 Apr 2008 08:14:40        [71.113.214.128] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:42        Smtp登录. IP: 71.170.147.132 , Port 2133
Fri, 25 Apr 2008 08:14:43        [71.113.214.128] 关闭连接.
Fri, 25 Apr 2008 08:14:44        Smtp登录. IP: 119.122.108.174 , Port 24121
Fri, 25 Apr 2008 08:14:45        拒收一封邮件, 原因: 域名[fuhwatrading.com]与发信IP地址[119.122.108.174]不匹配.
Fri, 25 Apr 2008 08:14:47        [71.170.147.132] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:47        [119.122.108.174] 关闭连接.
Fri, 25 Apr 2008 08:14:50        [71.170.147.132] 关闭连接.
Fri, 25 Apr 2008 08:14:51        Smtp登录. IP: 218.106.248.76 , Port 56899
Fri, 25 Apr 2008 08:14:52        [218.106.248.76] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:52        Smtp登录. IP: 71.210.164.72 , Port 3444
Fri, 25 Apr 2008 08:14:53        拒收一封邮件, 原因: 域名[borsariassociates.com]与发信IP地址[190.128.101.148]不匹配.
Fri, 25 Apr 2008 08:14:54        [218.106.248.76] 关闭连接.
Fri, 25 Apr 2008 08:14:55        Smtp登录. IP: 216.70.129.97 , Port 3005
Fri, 25 Apr 2008 08:14:55        [190.55.122.15] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:56        Smtp登录. IP: 63.111.179.165 , Port 40171
Fri, 25 Apr 2008 08:14:56        [71.210.164.72] 关闭Smtp连接.
Fri, 25 Apr 2008 08:14:58        [190.55.122.15] 关闭连接.
Fri, 25 Apr 2008 08:14:58        [190.128.101.148] 关闭连接.
Fri, 25 Apr 2008 08:14:58        [216.70.129.97] 关闭连接.
Fri, 25 Apr 2008 08:14:58        [71.210.164.72] 关闭连接.
Fri, 25 Apr 2008 08:15:02        [63.111.179.165] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:02        Smtp登录. IP: 218.91.234.158 , Port 52076
Fri, 25 Apr 2008 08:15:04        [63.111.179.165] 关闭连接.
Fri, 25 Apr 2008 08:15:05        拒收一封邮件, 原因: 域名[nle.com]与发信IP地址[218.91.234.158]不匹配.
Fri, 25 Apr 2008 08:15:08        [218.91.234.158] 关闭连接.
Fri, 25 Apr 2008 08:15:10        Smtp登录. IP: 189.82.56.237 , Port 2680
Fri, 25 Apr 2008 08:15:12        Smtp登录. IP: 206.46.172.63 , Port 54955
Fri, 25 Apr 2008 08:15:15        [206.46.172.63] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:15        [189.82.56.237] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:16        Smtp登录. IP: 218.18.198.51 , Port 4402
Fri, 25 Apr 2008 08:15:17        [218.18.198.51] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:18        [206.46.172.63] 关闭连接.
Fri, 25 Apr 2008 08:15:18        [189.82.56.237] 关闭连接.
Fri, 25 Apr 2008 08:15:18        [218.18.198.51] 关闭连接.
Fri, 25 Apr 2008 08:15:20        Smtp登录. IP: 92.74.113.7 , Port 3968
Fri, 25 Apr 2008 08:15:24        Smtp登录. IP: 60.171.142.153 , Port 50454
Fri, 25 Apr 2008 08:15:25        Smtp登录. IP: 216.129.90.205 , Port 41307
Fri, 25 Apr 2008 08:15:25        [92.74.113.7] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:26        拒收一封邮件, 原因: 域名[mail.ttlc.net]与发信IP地址[60.171.142.153]不匹配.
Fri, 25 Apr 2008 08:15:28        [216.129.90.205] 关闭Smtp连接.
Fri, 25 Apr 2008 08:15:28        [92.74.113.7] 关闭连接.
Fri, 25 Apr 2008 08:15:28        [60.171.142.153] 关闭连接.
Fri, 25 Apr 2008 08:15:28        [216.129.90.205] 关闭连接.
Fri, 25 Apr 2008 08:15:33        Smtp登录. IP: 201.223.20.206 , Port 29343
Fri, 25 Apr 2008 08:15:34        Smtp登录. IP: 71.105.61.183 , Port 50185
Fri, 25 Apr 2008 08:15:35        Smtp登录. IP: 125.78.49.13 , Port 41175
Fri, 25 Apr 2008 08:15:37        Smtp登录. IP: 125.34.148.128 , Port 2068
Fri, 25 Apr 2008 08:15:37        拒收一封邮件, 原因: 域名[bigfoot.com]与发信IP地址[125.34.148.128]不匹配.
Fri, 25 Apr 2008 08:15:39        [71.105.61.183] 关闭连接.
Fri, 25 Apr 2008 08:15:39        [125.34.148.128] 关闭连接.
Fri, 25 Apr 2008 08:15:39        拒收一封邮件, 原因: 域名[a-tsurgical.com]与发信IP地址[125.78.49.13]不匹配.

lz9999

域名[a-tsurgical.com]与发信IP地址[125.78.49.13]不匹配

这个不太明白是什么意思

rayer

就是说那这家伙伪造域名发信

smmwj

这个是别人利用你的服务器往外发垃圾邮件。每一封邮件一跳出来就会启用SCAN查毒。就占用资源造成很多进程，你是用MCAFEE作邮件防毒的吧。版本是不是8。0或以前的？你升级到8.5I应该就没问题了